Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 2026.4 to 2026.5 with no accompanying changes to sources, checksums, install scripts, or build logic. On its face this does not introduce any new security risk; however, because only .SRCINFO was changed and the underlying PKGBUILD/source integrity for the new version is not shown here, I can only assess the diff itself as low risk rather than fully verify the upstream release contents.

@@ -1,6 +1,6 @@
 pkgbase = mullvad-vpn-bin
 	pkgdesc = The Mullvad VPN client app for desktop
-	pkgver = 2026.4
+	pkgver = 2026.5
 	pkgrel = 1
 	url = https://www.mullvad.net
 	arch = x86_64

Comment

The change only bumps the upstream Mullvad binary release from 2026.4 to 2026.5 for both amd64 and arm64, while keeping the download URLs on the official GitHub releases page and preserving the detached signature files. No new sources, scripts, build steps, or privilege-related artifacts are introduced in this .SRCINFO-only update. This is a routine version refresh with no obvious security red flags in the diff provided.

@@ -15,13 +15,13 @@ pkgbase = mullvad-vpn-bin
 	source = mullvad-vpn.sh
 	validpgpkeys = A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF
 	sha256sums = a59c29f07b4eab9af56f0e8be42bae0d83726f5185e88de0c5a48f4098c3c0a4
-	source_x86_64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_amd64.deb
-	source_x86_64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_amd64.deb.asc
-	sha256sums_x86_64 = f1d758079e1dc90fff0c8d48256599b717e1de9879682c861a6776851c59453b
+	source_x86_64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.5/MullvadVPN-2026.5_amd64.deb
+	source_x86_64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.5/MullvadVPN-2026.5_amd64.deb.asc
+	sha256sums_x86_64 = aa6bd00452588597f50e8ca2f02bb91e9c295c4f01b0ae907354552e7428e7ab
 	sha256sums_x86_64 = SKIP
-	source_aarch64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_arm64.deb
-	source_aarch64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.4/MullvadVPN-2026.4_arm64.deb.asc
-	sha256sums_aarch64 = 39d897f425f77c3fe49902cf2f3d58a02c812d482a22f95dfc069526f58e1d09
+	source_aarch64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.5/MullvadVPN-2026.5_arm64.deb
+	source_aarch64 = https://github.com/mullvad/mullvadvpn-app/releases/download/2026.5/MullvadVPN-2026.5_arm64.deb.asc
+	sha256sums_aarch64 = e62878f203ecd1037e45bf8158e6b40f5dc99547c714a426135c0be6f2379940
 	sha256sums_aarch64 = SKIP
 
 pkgname = mullvad-vpn-bin

Comment

The change only adds `use_max_release = true` to `.nvchecker.toml` for the upstream Mullvad VPN app Git source. This affects version selection in nvchecker, not package build or install behavior. The source remains the official HTTPS GitHub repository, and there are no new build-time downloads, scripts, privilege changes, or packaging actions introduced by this diff. The main risk is limited to potentially preferring the highest release tag rather than the latest chronological one, which is a metadata/update-policy choice rather than a security issue.

@@ -1,4 +1,5 @@
 [mullvad-vpn-bin]
 source = "git"
 git = "https://github.com/mullvad/mullvadvpn-app.git"
+use_max_release = true
 exclude_regex = ".*(alpha|beta|rc).*"

Comment

The change is a routine version bump with updated release checksums. The only behavioral change is removal of the `chmod 4755` on `chrome-sandbox`, which reduces privilege rather than adding it. Source URLs remain on the official GitHub release page over HTTPS, and there are no new build-time downloads, scripts, or install-time persistence mechanisms introduced by this diff. No security issue is evident in the reviewed hunk.

@@ -6,7 +6,7 @@ pkgname=(
   'mullvad-vpn-daemon-bin'
 )
 pkgbase=mullvad-vpn-bin
-pkgver=2026.4
+pkgver=2026.5
 pkgrel=1
 pkgdesc="The Mullvad VPN client app for desktop"
 arch=('x86_64' 'aarch64')

Comment

The change is low risk. It only updates the package version and the expected SHA-256 checksums for the upstream .deb artifacts, and it removes the explicit chmod 4755 on chrome-sandbox. That removal reduces privilege-related risk rather than adding it. I did not see any new network fetches, install-script changes, or other suspicious packaging behavior in this diff.

@@ -24,9 +24,9 @@ source=('mullvad-vpn.sh')
 source_x86_64=("https://github.com/mullvad/mullvadvpn-app/releases/download/$pkgver/MullvadVPN-${pkgver}_amd64.deb"{,.asc})
 source_aarch64=("https://github.com/mullvad/mullvadvpn-app/releases/download/$pkgver/MullvadVPN-${pkgver}_arm64.deb"{,.asc})
 sha256sums=('a59c29f07b4eab9af56f0e8be42bae0d83726f5185e88de0c5a48f4098c3c0a4')
-sha256sums_x86_64=('f1d758079e1dc90fff0c8d48256599b717e1de9879682c861a6776851c59453b'
+sha256sums_x86_64=('aa6bd00452588597f50e8ca2f02bb91e9c295c4f01b0ae907354552e7428e7ab'
                    'SKIP')
-sha256sums_aarch64=('39d897f425f77c3fe49902cf2f3d58a02c812d482a22f95dfc069526f58e1d09'
+sha256sums_aarch64=('e62878f203ecd1037e45bf8158e6b40f5dc99547c714a426135c0be6f2379940'
                     'SKIP')
 validpgpkeys=('A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF') # Mullvad (code signing) <admin@mullvad.net>
 

Comment

The only behavioral change in this diff is removal of `chmod 4755 "$pkgdir/opt/Mullvad VPN/chrome-sandbox"` from package() while bumping to a new upstream release and updating checksums. This reduces privilege rather than adding it: the package no longer installs the Chromium sandbox helper as setuid-root, which is a security hardening change and not a persistence/escalation risk. The rest of the diff is just version/checksum updates for official GitHub release artifacts over HTTPS with PGP verification. No suspicious downloads, scripts, or install-time privilege changes are introduced in the reviewed hunk.

@@ -44,7 +44,6 @@ package_mullvad-vpn-bin() {
   install='mullvad-vpn.install'
 
   bsdtar -xvf data.tar.xz -C "$pkgdir/"
-  chmod 4755 "$pkgdir/opt/Mullvad VPN/chrome-sandbox"
 
   # Remove useless changelog.gz & symlink actual changelog
   rm "$pkgdir/usr/share/doc/mullvad-vpn/changelog.gz"